What we hold, and what we never do

It is first-party and cookieless. Vercel Web Analytics sets no cookie and stores no identifier on your device, so it cannot follow you between sessions or across other websites. There is no profile of you anywhere, because there is nothing to attach one to.

What we see is a count. Specifically:

• Which page was viewed, and the referring site if there was one.
• Which buttons were clicked: downloads and the platform chosen, GitHub links, quickstart commands copied, and which FAQ entries were opened.
• Coarse technical context that arrives with any web request: country, browser, and whether you are on a phone or a desktop.

We never record your screen, replay your session, watch your mouse, or capture anything you type. We do not run heatmaps. The four commitments below apply to this website exactly as they apply to the apps.

You can switch it off with any content blocker, and the site works identically. Nothing on this site depends on being counted.

Receives, not stores. The gateway writes no database row and logs no request; a notification exists only for as long as forwarding it takes.

• Your phone's push token, which is the thing that lets Apple or Google wake that specific device.
• Identifiers for the server, project and thread the notification came from, which the phone uses to open the right screen. They are opaque to us and resolve to nothing we hold.
• The notification title and body, for exactly as long as forwarding it takes. Nothing is written to a database and no request is logged. If you turn notification previews off on a device, the text is only which project and what kind of event.

This path is used by every installation with a phone paired to it, including free, local-only and self-built ones, because requiring an account to receive a notification would put a signup in front of the free product.

These commitments are the same ones shown inside the mobile app, and they apply to every part of ThreadKnot:

Push delivery uses Apple Push Notification service and Firebase Cloud Messaging, because that is the only way a phone can be woken.

• Expo

  Carries a notification from the gateway to Apple or Google. It receives the push token, the title and body, and the small routing payload, never an account or installation identifier. Their privacy policy.

• Apple Push Notification service

  Delivers notifications to iPhones and iPads. Their privacy policy.

• Firebase Cloud Messaging

  Delivers notifications to Android devices. Their privacy policy.

• Vercel

  Serves this website and the subscriber console, and handles their technical logs. It is never on the path between a device and your machine. Their privacy policy.

This is the complete list, taken from the database schema. There is no other table and no other store: no object storage, no log archive, no analytics pipeline.

• Your account and organisation: an internal id, the identity-provider id, a display name, an email address if your sign-in carries one, and when it was created.
• One row per machine you enrol: its assigned public hostname label, the machine name you gave it for display, whether it is switched on, its plan and entitlement state, and when it was created and last seen.
• The public half of each machine's identity key. The private half is generated on that machine and never leaves it.
• Usage totals: one row per machine per hour holding bytes in, bytes out and the peak number of concurrent streams. That is the entire metering record.
• A count of devices against your device allowance, as opaque ids. What those devices are and what they may do stays on your own machine.
• Subscription state from Stripe: customer and subscription ids, status, price, period and trial end. No card data, because Stripe collects payment details directly and we never receive them.

• No request URLs, methods, headers or bodies.
• No WebSocket frames, terminal output, screencast frames or file contents.
• No prompts, agent output, thread contents or repository contents.
• No content of any kind, in any form, anywhere in the relay path. Nothing from the stream is written to disk.

Metering is byte counters and connection metadata. We count how much moved, never what moved.

Payments are handled by Stripe (privacy policy), acting as our payment processor. Stripe collects your payment details directly and we never receive or store your card number. We hold your billing email, your subscription status and plan, and the Stripe identifiers that tie them together.

Billing records have to be kept for as long as tax and accounting law requires, even after you close your account, and Stripe retains its own records under its own obligations.

• Stripe

  Billing. Receives your billing email if we hold one, and an internal organisation id. Collects payment details directly, so we never receive or store card data. Their privacy policy.

• Clerk

  Signs you in to the console. Holds your account identity, sign-in events and organisation membership. It never authenticates a machine or a phone, and it is never on the data path. Their privacy policy.

• LynxLabs

  Hosts the relay server, in the United States. A hosting provider has infrastructure access to the machine it hosts, which is true of any hosted service and worth naming rather than omitting. Their privacy policy.

• Cloudflare

  DNS only, with no proxy on any record, so no traffic of yours passes through it. Its API is used solely to prove domain control during certificate renewal. Their privacy policy.

• Let's Encrypt

  Issues the relay's certificate. It is a wildcard, so your individual machine's hostname is never published to the public certificate transparency logs. Their privacy policy.

You can switch a machine off from the console at any time. It stops being reachable within about fifteen seconds, its live tunnel is closed, and its public address returns the same generic response an unknown address gets. Turning it back on needs nothing done at the machine.

Deleting a machine from the console removes it and everything that hangs off it, meaning its keys, its usage history and its device counts, and drops it from the relay within about fifteen seconds.

Closing an account entirely is done by writing to support@smithnetworksolutions.com, not by a button, and we will confirm when it is done. We would rather say that than point you at a control that does not exist. Operational log lines on the relay host, which hold byte totals and connect or disconnect events and never content, can outlive the deleted record.

The four commitments apply to paid exactly as they apply to free:

A subscription buys you a route to your own machines. It never buys us a right to your content.